KeyPair::from_pem detects incorrect algorithm?
Open
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 505
- Forks
- 157
- Avg merge
- 39m
- Merged PRs (30d)
- 1
Description
How to reproduce
Test certificates
Working certificates (-sha256 option)
openssl req -x509 \
-sha256 -days 356 \
-nodes \
-newkey rsa:4096 \
-subj "/CN=example.com" \
-keyout rootCA.key -out rootCA.crt
Failing certificates (-sha512 option)
openssl req -x509 \
-sha512 -days 356 \
-nodes \
-newkey rsa:4096 \
-subj "/CN=example.com" \
-keyout rootCA.key -out rootCA.crt
Code
use std::fs::read_to_string;
fn main() {
let private_key = read_to_string("rootCA.key").unwrap();
let private_key = rcgen::KeyPair::from_pem(&private_key).unwrap();
println!("KeyPair alg: {:?}", private_key.algorithm());
let cert = read_to_string("rootCA.crt").unwrap();
let params = rcgen::CertificateParams::from_ca_cert_pem(&cert, private_key).unwrap();
println!("Params alg: {:?}", params.alg);
if let Err(e) = rcgen::Certificate::from_params(params) {
println!("Error: {:#}", e);
} else {
println!("All good :-)")
};
}
Test results
If using the -sha256 certificate files, the output is:
KeyPair alg: PKCS_RSA_SHA256
Params alg: PKCS_RSA_SHA256
All good :-)
If using the -sha512 certificate files, the output is:
KeyPair alg: PKCS_RSA_SHA256
Params alg: PKCS_RSA_SHA512
Error: The provided certificate's signature algorithm is incompatible with the given key pair
Is this expected?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue with the supplied OpenSSL commands and Rust example, then inspect KeyPair::from_pem and CertificateParams::from_ca_cert_pem to compare the SHA-256 and SHA-512 algorithm values. Done means establishing whether the differing algorithms are expected and documenting or covering the correct compatibility behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cryptography
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100